Re: The weirdest problem I have ever met

2009-05-07 Thread Jodizzz
Ok, I went down to the client and did some tests. For easy to understand, I am going to call this problem email account problemacco...@clientdomain.com (of cos actual domain is replaced with clientdomain.com for obstructing purpose. My email account I would call it jodi...@mydomain.com (of cos

Re: The weirdest problem I have ever met

2009-05-07 Thread Jonas Eckerman
Jodizzz wrote: Result: Email was labelled as very very high spam. Mail headers as below Unfortunately those headers does not include the actual rules that hit. Without knowing this, we can only give you educated guesses. Please include the lists of hits for the message. It should be

Re: sa-learn process overhwelming the server

2009-05-07 Thread Matus UHLAR - fantomas
On 6-May-2009, at 06:50, Karsten Bräckelmann wrote: To determine if a mail already has been learned, SA needs to have a look at the mail. On 06.05.09 17:34, LuKreme wrote: Mightn't it be helpful if it could keep a cache of filenames? Useless, they can change. I hope that SA reads only

custom scores not working

2009-05-07 Thread Arvid Ephraim Picciani
greetings, with 3.2.5 i can't get custom scores working. i usually added them in /etc/mail/spamassassin/x_90_scores.cf but that won't work anymore so i added them at the bottom of /etc/mail/spamassassin/local.cf but no luck either. for example i have: score HTML_MESSAGE 0.1 but sa still

Re: Rule to detect same address in sender and receiver

2009-05-07 Thread Matus UHLAR - fantomas
On 07.05.09 03:59, jida...@jidanni.org wrote: Ah ha, you can use something like header FROM_SAME_AS_TO ALL=~/\nFrom: ([^\n]+)\n.*To: \1/sm add spf to your domain But see e.g., http://david.woodhou.se/why-not-spf.html did I misread ot does the person blame SRS first and then reports he uses

Re: custom scores not working

2009-05-07 Thread Matt Kettler
Arvid Ephraim Picciani wrote: greetings, with 3.2.5 i can't get custom scores working. i usually added them in /etc/mail/spamassassin/x_90_scores.cf but that won't work anymore so i added them at the bottom of /etc/mail/spamassassin/local.cf but no luck either. for example i have:

Re: custom scores not working

2009-05-07 Thread Arvid Ephraim Picciani
*facepalm* I was testing an already scored message and reading the wrong report. Thanks anyway, and sorry.

Re: custom scores not working

2009-05-07 Thread LuKreme
On 7-May-2009, at 06:05, Arvid Ephraim Picciani wrote: greetings, with 3.2.5 i can't get custom scores working. i usually added them in /etc/mail/spamassassin/x_90_scores.cf This is NOT how you add custom scores to SA. but that won't work anymore so i added them at the bottom of /etc/

Re: custom scores not working

2009-05-07 Thread Karsten Bräckelmann
On Thu, 2009-05-07 at 07:28 -0600, LuKreme wrote: with 3.2.5 i can't get custom scores working. i usually added them in /etc/mail/spamassassin/x_90_scores.cf This is NOT how you add custom scores to SA. Uhm, pardon? I have lots of custome scores in my local.cf file. [...] -- char

Re: sa-learn process overhwelming the server

2009-05-07 Thread Kevin Parris
Yes, the learn client does not try to keep up with what it has done, or not done, before - that is handled by the server (the Bayes engine). I believe there is no reasonable way for the client to achieve this, anyway - it cannot reliably modify your maildir in such a way that it can be assured

Re: The weirdest problem I have ever met

2009-05-07 Thread John Hardin
On Thu, 7 May 2009, Jodizzz wrote: Test 1: I send an email from my user's pc at their LAN (Connecting to their own ISP) and used problemacco...@clientdomain.com to send an email to myself jodi...@mydomain.com. Result: Email was labelled as very very high spam. Mail headers as below

Image-only spams

2009-05-07 Thread John Hardin
All: Okay, the spammers finally started sending these to me, and they are pretty distictive. Try this: header __CTYPE_MULTIPART_MXD Content-Type =~ /multipart\/mixed/i mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i meta MIME_IMAGE_ONLY (__CTYPE_MULTIPART_MXD

Re: Image-only spams

2009-05-07 Thread Justin Mason
done. we need to sort out that committer account so you can put it there yourself ;) --j. On Thu, May 7, 2009 at 17:20, John Hardin jhar...@impsec.org wrote: All: Okay, the spammers finally started sending these to me, and they are pretty distictive. Try this: header    

Re: Image-only spams

2009-05-07 Thread Charles Gregory
Sweet! I was trying to puzzle my way around the logic but couldn't figure this one out. Pretty simple once I see it. THANKS! - Charles On Thu, 7 May 2009, John Hardin wrote: Okay, the spammers finally started sending these to me, and they are pretty distictive. Try this: header

Re: Image-only spams

2009-05-07 Thread John Hardin
On Thu, 7 May 2009, Charles Gregory wrote: Sweet! I was trying to puzzle my way around the logic but couldn't figure this one out. Pretty simple once I see it. THANKS! Thank me if it works... :) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.org

Re: Image-only spams

2009-05-07 Thread Charles Gregory
On Thu, 7 May 2009, John Hardin wrote: Thank me if it works... :) Just fired one of my latest image spams through it and it triggered fine. So until the spammers adapt... THANKS! :) - Charles

Re: custom scores not working

2009-05-07 Thread Kris Deugau
LuKreme wrote: On 7-May-2009, at 06:05, Arvid Ephraim Picciani wrote: greetings, with 3.2.5 i can't get custom scores working. i usually added them in /etc/mail/spamassassin/x_90_scores.cf This is NOT how you add custom scores to SA. ... And, why not? I used extra .cf files in

Odd behaviour under load.

2009-05-07 Thread Charles Gregory
Hallo! Just wanted to throw in an observation on my system's behaviour with spamassassin 'overloaded' Not really a complaint, as I know what I did 'wrong'. But curious about one of the effects During the recent run of image spams, I tried a couple of different pieces of code that

Re: Odd behaviour under load.

2009-05-07 Thread John Hardin
On Thu, 7 May 2009, Charles Gregory wrote: So obviously some systems were 'timing out' waiting for my server to respond to the DATA command. Heh. Does the SMTP protocol need a 100 Please hold... reply? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: Image-only spams

2009-05-07 Thread Bob Proulx
John Hardin wrote: Thank me if it works... :) It works. This was exactly what I was asking for too. Thank you very much! Bob

Re: The weirdest problem I have ever met

2009-05-07 Thread Jodizzz
Here it is. May 7 15:58:56 mail2 spamd[3060]: spamd: checking message 79bfa64f2c2d4a50b1c00aedbb24f...@pc04 for qscand:511 May 7 15:58:56 mail2 spamd[3060]: spamd: result: Y 667 - AWL,BAYES_00,DOS_OE_TO_MX,FORGED_MUA_OUTLOOK,HTML_MESSAGE,USER_IN_WHITELIST

Re: The weirdest problem I have ever met

2009-05-07 Thread John Hardin
On Thu, 7 May 2009, Jodizzz wrote: May 7 15:58:56 mail2 spamd[3060]: spamd: checking message 79bfa64f2c2d4a50b1c00aedbb24f...@pc04 for qscand:511 May 7 15:58:56 mail2 spamd[3060]: spamd: result: Y 667 - AWL,BAYES_00,DOS_OE_TO_MX,FORGED_MUA_OUTLOOK,HTML_MESSAGE,USER_IN_WHITELIST ^^^ Yep.

Re: Odd behaviour under load.

2009-05-07 Thread SM
At 13:15 07-05-2009, John Hardin wrote: Heh. Does the SMTP protocol need a 100 Please hold... reply? No. Fix the mail server instead of the protocol. Regards, -sm